Wildfire Reports missing URL

r_buchwalder — Wed, 26 May 2021 09:08:40 GMT

Hello all

I did some PDF-Requests to Wildfire and getting Info back as xml.

One of those reports are marked as "Malicious" but I do not see, what/why it is Malicious.
So I've investigated and did a curl extract of the sha265 Wildfire Request.

And look! There are infos about URLs in the curl-api request (output as xml):

<extracted_urls>
<entry domain="blablabla.com" verdict="something"/>
</extracted_urls>

and

<entry score="0.0" id="8016" details="File may reference external resources through the URL/domain name/IP address. Both benign and malicious samples can have this behavior.">
File contains one or more URL/domain name/IP address
</entry>
</summary>

Why is it not in the Integration?

So, I did a copy of the Integration and inserted a dirty "update" on it:

(Integration "Palo Alto Networks WildFire v2", Version 1.3.3 - 322974 (Apr 8, 2021))

I've inserted following lines at line 605:

605:

606: if 'extracted_urls' in report:
607: feed_related_indicators.append({'value': report["extracted_urls"], 'type': 'URL'})

608:

Next lines would be: (To find it easier to modify)

608:

609: outputs = {
610: 'Status': 'Success',
611: 'SHA256': file_info.get('sha256')
612: }

613:

Right now, the Output is with brakets [] and ":

${File.FeedRelatedIndicators.value.entry.@domain}
["blablabla.com"]

${File.FeedRelatedIndicators.value.entry.@verdict}
["something"]

Now my question:
Is Palo Alto able to Update the Integration?

Thanks
roger

Re: Wildfire Reports missing URL

gfilippov — Tue, 15 Jun 2021 08:23:19 GMT

Hi,
You can contribute this content via the marketplace, it will be reviewed by our content development team and merged to our content if approved,
thanks.

topic Wildfire Reports missing URL in Cortex XSOAR Discussions

Wildfire Reports missing URL

Re: Wildfire Reports missing URL